Decoder: Network Rules Tab

Document created by RSA Information Design and Development on Mar 22, 2017Last modified by RSA Information Design and Development on Sep 25, 2017
Version 3Show Document
  • View in full screen mode
  

This topic describes the features for creating and managing network rules in the Services Config view > Network Rules tab.

The Network Rules tab enables you to manage network rules. Security Analytics applies network rules at the packet level. Network rules consist of rule sets from Layer 2, Layer 3, and Layer 4. Multiple rules can be applied to the Decoder. Rules can be applied to multiple layers (for example, when a network rule filters out specific ports for a specific IP address). Network rules apply only to packet Decoders.

Step 4. Configure Decoder Rules provides additional information and Configure Network Rules provides instructions for creating network rules.

The toolbar on the Network Rules tab is common to all types of rules. Services Config View - Rules Tabs provides information on the common rules toolbar and actions.

To access the Network Rules tab:

  1. In the Security Analytics menu, select Administration > Services.
  2. Select a Decoder service and select  Actions menu cropped > View > Config.
    The Config view for the selected service is displayed.
  3. Select the Network Rules tab.

The following figure shows the Network Rules tab.

NetRulesTb.png

The following figure shows the Rule Editor dialog for a network rule.

NetRuleEditorEx2.png

Features

The following table describes the columns in the Network Rules grid.

                                 
ColumnDescription
Pending This column indicates whether a rule has pending changes. Rules that are currently active on the Decoder have no indicator. If the rule is new or has been modified, the column contains ic-pending2.png. Once the rules are applied, the pending indicator is removed.
Name This is the rule name, a descriptive identifier for the rule.
Condition This is the definition of the condition that triggers an action when matched.
PacketData This column displays the Session Data action taken when a packet matches the rule. Possible values are Filter, Keep, or Truncate.
Alert This column indicates whether the Decoder generates a custom alert when metadata matches the rule. Possible values are Enabled or Disabled.
Status This column indicates whether the rule is enabled or disabled with a circle icon. If the circle is filled green, the rule is enabled. If the circle is empty, the rule is disabled.

The Rule Editor dialog provides the fields and options needed to define a network rule.

The following table describes the Rule Definition fields.

                     
FieldDescription
Rule Name The descriptive name that identifies the rule.
Condition

The definition of the condition that triggers an action when matched. You can type directly in the field or build the condition in this field using meta from the Intellisense window actions. As you build the rule definition, Intellisense displays syntax errors and warnings.

In conditions, all string literals and time stamps must be quoted. Do not quote number values and IP addresses. Rule and Query Guidelines provides additional details.

Supported Meta Keys in Network Rules describes the meta keys that Security Analytics supports for use in network rule conditions.

The following table describes the Session Data actions.

                         
ActionDescription
Stop Rule Processing If checked, further rule evaluation ends if the rule is matched, and the session is saved as indicated. If not checked, rule evaluation continues until all rules are evaluated.
Keep The packet payload and associated meta are saved when they match the rule.
Filter The packet is not saved when it matches the rule.
Truncate The packet payload is not saved when it matches the rule, but packet headers and associated meta are retained.

The following table describes the session options. 

                         
OptionDescription
Assemble If checked, the assembler assembles the packet chain when it matches the rule.
Network Meta The packet generates network metadata when it matches the rule.
Application Meta The packet generates application metadata when it matches the rule.
Alert The packet generates a custom alert when metadata matches the rule.

The following table describes Rule Editor dialog actions. 

                         
ActionDescription
Reset Resets the contents of the dialog to their values before editing; changes are discarded.
Cancel Cancels any edits and closes the Rule Editor dialog.
OK Saves the new rule or edited rule, and adds it to the rules grid. The Rule Editor dialog closes.
Save (Rules with deprecated syntax only) Applies a corrected rule individually to the Decoder service. See Fix Rules with Deprecated Syntax.
Previous Topic:Correlation Rules Tab
You are here
Table of Contents > References > Services Config View - Rules Tab > Network Rules Tab

Attachments

    Outcomes